Home / Trending

PHP2Shell Internet Outage: Why Websites Went Dark

By BeginnerBudget Team · Updated October 2026 · 14 min read

One day a website works. The next day it is gone — no error message from hackers, no ransom note, just darkness. That is what millions of people experienced in the third week of October 2026, and it felt like the internet itself was breaking. It was not. It was the internet protecting itself, in the most dramatic way possible: by switching parts of itself off before attackers could break in. This guide explains, in plain English, what PHP2Shell is, why the outage happened, who went dark and why, what it means for your money, and what happens next — because experts say this was not a one-off.

What Happened, Day by Day

The key point in that timeline: the outage was not a single moment when something broke. It was a rolling, deliberate shutdown over three days, as thousands of organisations each made the same decision independently — patch immediately, or go dark until you can.

What Is PHP2Shell, in Plain English?

PHP is a programming language that runs on web servers — the computers that send you a website when you type in an address. It powers a substantial proportion of the world's websites and applications, from small blogs to massive corporate portals. Some estimates put the share at around 70% of the web; Pakistan's National CERT put it at up to 77%. When a flaw is found in PHP itself, it does not affect one website — it potentially affects millions of them at once.

PHP2Shell is the collective name for two flaws found in fundamental parts of PHP's memory management and error handling, rather than in any particular website application or plugin:

• CVE-2026-109618 and CVE-2026-109619 — the two official vulnerability identifiers.
• Severity 9.2 out of 10 under CVSS v4.0 — the "critical" rating, near the top of the scale.
• What an attacker could do: execute malicious code on a vulnerable web server without needing to log in — potentially gaining control of the system and accessing private files or databases.
• How they were found: researchers at cybersecurity firms Wiz and Calif used advanced AI tools provided through an OpenAI initiative to spot flaws that had remained hidden for over a decade. The finding was later confirmed independently using Google's Gemini 4 Argon model. Experts described them as some of the most severe flaws ever detected by AI.

Think of it this way: if every house on a street uses the same brand of lock, and someone discovers that lock can be opened with a paperclip, every house is at risk at the same time — even though nobody has been robbed yet. The correct response is to change the locks immediately, or lock the doors and stay inside until you can. That is exactly what website owners did.

Why Did Websites Go Dark If Nobody Was Hacked?

This is the part most people found confusing, so it is worth stating clearly: most of the reported outages were temporary security measures, not evidence that the affected organisations had been hacked. The logic ran like this:

1. The flaws were public (leaked a day before the patch), so attackers already knew about them.
2. Exploitation attempts escalated into the millions within hours of disclosure, according to Cloudflare's reporting.
3. Patching takes time — you have to test the patch, apply it, and restart services, and for a large organisation that can take days.
4. While a site is unpatched and online, it is exposed. While it is offline, it cannot be attacked through that flaw.

So organisations that could not patch fast enough chose the safer option: pull the site down until it was safe. National security agencies explicitly advised this — the USA's NSA and FBI, and agencies in Finland and the Netherlands, all told organisations to take websites offline if they could not immediately apply the emergency patch. The US Federal Bureau of Investigation urged organisations to update PHP installations or take systems offline until mitigation was complete.

That is also why the outage felt so strange: the sites were not "down" in the usual sense. Their owners had deliberately turned the lights off, the way you would switch off the electricity while fixing faulty wiring.

Who Went Dark?

The shutdowns touched almost every kind of organisation, which is why it felt like the whole internet was affected:

• Governments: government departments across Europe; the South African Presidency's website (taken offline on 23 October following the warnings); the Dutch parliament's website; Finnish public services; government websites in Australia, the Netherlands, and France, including the Paris Police website.
• Japan: major organisations including banks, airlines, and railway operators, after the disruption spread there on Thursday. The Japanese Prime Minister and the South Korean government issued emergency orders requiring businesses and technical agencies to update their software immediately.
• Media and knowledge: various BBC programme pages and parts of Wikipedia were momentarily inaccessible, and the Wikimedia Foundation (which operates Wikipedia) proactively suspended many support services.
• Businesses and services: insurance companies, transportation services, media outlets, and many popular entertainment apps went through unexpected maintenance.
• Pakistan: placed on high cyber alert, with the National CERT auditing 300 government websites in response to the flaws.

Amazon also confirmed publicly that hackers were actively trying to break into websites by leveraging the flaws. The scale is the story: when a flaw sits in the foundation of the web, the outage list reads like a phone book of modern life.

It Was Not Just PHP: "Black October"

October 2026 earned the nickname "Black October" in cybersecurity circles because PHP was not the only crisis that week. The same week brought disclosures of critical flaws in the PHP alternative Node.js (dubbed Node2Shell, severity 9.8 — even higher than PHP2Shell) in its Brotli decoder, and in the web framework Next.js, plus breaches tied to the AI gateway LiteLLM and the development platform Railway, and the revelation that the Indian certificate authority eMudhra had used an extraordinarily flimsy cryptographic key that potentially put users across the internet at risk.

That pile-up is why experts are warning this was not a one-off. Matthew Prince, the CEO of Cloudflare, said he was aware of "a bunch of additional severe vulnerabilities that are present in other pieces of critical software" and predicted busy months ahead as AI surfaced long-hidden weaknesses in the fabric of the internet. His widely quoted line: "I think we're going to have a couple of years where every single week it's going to feel like the sky is falling." Research firm VulnCheck reported that AI helped drive a doubling of the number of digital flaws discovered year-on-year.

The deeper shift, in the words of Wharton professor Ethan Mollick, is that AI-powered attack and scanning tools are forcing the entire digital world into an era of "super-fast updates" — where any delay in patching comes at a high price. The week of the PHP2Shell outage was that era arriving all at once.

For background on how the week unfolded, see the experts' warning on further outages, the detailed PHP2Shell timeline, and the Pakistan cyber-alert report.

UK vs USA: How the Two Governments Responded

Both responses are consistent — the UK spoke to citizens about resilience, the USA spoke to organisations about patching — and together they show how seriously governments took a flaw that, a week earlier, almost nobody outside cybersecurity had heard of.

What It Means for Your Money

For most people, the PHP2Shell week cost nothing directly. But it exposed three money risks worth taking seriously, because all three will recur as AI keeps finding flaws:

• Payments can stop working. If banks, payment processors, or supermarket systems go offline — as the UK warnings explicitly contemplated — cards and apps can fail even when your money is safe. A small cash buffer at home covers groceries and transport for a few days. This is not doomsday preparation; it is the same 72-hour thinking behind the UK's Be Ready checklist, and it costs almost nothing.
• Your emergency fund is your outage fund. The same buffer that covers a broken boiler covers a week when your bank's app is down or your freelance platform is offline. If you do not have one yet, our guide to building an emergency fund from zero starts with £500–£1,000 in the UK (about $1,000 in the USA) before building to 3–6 months of essentials.
• Budgeting apps need the internet — your budget should not. If your budgeting app or bank app goes dark, you still need to know what you can spend. Keep a simple offline record — even a notes app with your monthly totals — so a tech outage never becomes a money surprise. Our beginner's budgeting guide shows the full setup, and our roundup of the best free budgeting apps is worth re-reading with one question in mind: what do I do when the app itself is down?

One more money point: beware of scams that follow outages. After any big tech incident, phishing messages spike — fake "security update" emails, fake bank warnings, fake patch downloads. A real bank will never ask you to download a patch from an email link. If in doubt, go to the official site or app yourself, never through a link someone sent you.

What Happens Next — and How to Prepare

Experts are unusually united on one prediction: there will be more weeks like this one. AI is now finding flaws faster than humans ever did, and many of those flaws have been sitting in widely used software for a decade or more. Cloudflare's CEO expects "a couple of years" of repeated scares. That does not mean the internet is doomed — it means the maintenance cycle of the internet just got much faster, and everyone, from governments to app developers to ordinary users, has to keep up.

What you can actually do, as an ordinary person:

1. Keep your devices and apps updated. Automatic updates on — phone, laptop, browser, banking apps. Most patches for flaws like these reach consumers as ordinary updates; installing them promptly is the single highest-value habit.
2. Turn on two-factor authentication (2FA) on your email, bank, and main accounts, ideally with an authenticator app rather than SMS.
3. Keep offline copies of the essentials: account numbers, insurance details, and a month's budget totals, somewhere you can reach them without the internet.
4. Keep a small cash buffer at home — enough for a few days of groceries and transport, as the UK's Be Ready guidance suggests.
5. Do not click "security update" links in emails or texts. Updates come through official app stores and the software itself, never through a link a stranger sent you.

For website owners, the lesson from the outage week is equally blunt: maintain an accurate inventory of your server software, apply security updates promptly, and investigate any evidence of suspicious activity rather than assuming a precautionary shutdown means you were breached — or that being online means you were safe.

Frequently Asked Questions

The PHP2Shell week will be remembered as the week the internet learned to flinch — thousands of organisations deciding, independently and within hours, that darkness was safer than exposure. It was disruptive, it was frightening, and it was also the system working as it should: a flaw was found, a patch was released, and the vulnerable went quiet until they were safe. The next one will come faster. The people who will barely notice it are the ones with updates on, two-factor on, records offline, and a buffer in place — which, happily, is the same checklist that makes your money resilient to almost anything else.